Brocade MLX Series and Brocade NetIron XMR Diagnostic Guide ...

Denial of Service attacks 9802.1X: Timer tick expired802.1X: Timer tick expired802.1X: Timer tick expired802.1X: port 4/1 aWhile timer (Supplicant) started for 30 secs802.1X: port 4/1 aWhile timer (AuthServer) started for 30 secs802.1X: port 4/1 aWhile timer (AuthServer) started for 30 secs802.1X: Timer tick expired802.1X: port 4/1 aWhile timer (Supplicant) started for 30 secs802.1X: port 4/1 aWhile timer (AuthServer) started for 30 secs802.1X: Timer tick expired802.1X: Port 3/15 txEAP timer expired. Transmitting an EAP ReqId802.1X: Port 3/17 txEAP timer expired. Transmitting an EAP ReqId802.1X: Port 3/18 txEAP timer expired. Transmitting an EAP ReqId802.1X: Port 3/19 txEAP timer expired. Transmitting an EAP ReqId802.1X: Port 3/20 txEAP timer expired. Transmitting an EAP ReqId802.1X: port 4/1 aWhile timer (AuthServer) started for 30 secs802.1X: port 4/1 aWhile timer (Supplicant) started for 30 secs802.1X: port 4/1 aWhile timer (AuthServer) started for 30 secs802.1X: Timer tick expired802.1X: port 4/1 aWhile timer (AuthServer) started for 30 secs802.1X: port 4/1 aWhile timer (Supplicant) started for 30 secs802.1X: port 4/1 aWhile timer (AuthServer) started for 30 secs802.1X: Timer tick expiredConfiguration notes• The client’s 802.1x MAC session establishes a relationship between the user name and theMAC address used for authentication. If a user attempts to gain access from different clients(with different MAC addresses), the user must be authenticated from each client.• If a client has been denied access to the network (that is, the client’s 802.1x MAC session isset to “access-denied”), then you can cause the client to be re-authenticated by manuallydisconnecting the client from the network, or by using the clear dot1x mac-session command.• When a client has been denied access to the network, the 802.1x MAC session is aged out ifno traffic is received from the client’s MAC address over a fixed hardware aging period (70seconds), plus a configurable software aging period. You can optionally change the softwareaging period for 802.1x MAC sessions or disable aging altogether. After the denied client’s802.1x MAC session is aged out, traffic from that client is no longer blocked, and the client canbe re-authenticated.• To implement 802.1x port security, at least one of the RADIUS servers identified to the Brocadedevice must support the 802.1x standard.Denial of Service attacksIn a Denial of Service (DoS) attack, a router is flooded with useless packets, hindering normaloperation. Brocade devices include measures for defending against two types of DoS attacks:Smurf attacks and TCP SYN attacks.A Smurf attack is a kind of DoS attack where an attacker causes a victim to be flooded with ICMPecho (Ping) replies sent from another (intermediary) network. For detailed information about how toprevent Smurf attacks, refer to the NetIron Series Configuration Guide.Brocade MLX Series and Brocade NetIron XMR Diagnostic Guide 30753-1002426-02